Analysis of third party networks

ABSTRACT

A method of analyzing customer behavior, where customers are engaged in customer-to-customer transactions in the third-party network, includes the transformation of data representing the customer-to-customer transactions from a data representation to a network representation, and then analyzing the network representation. The network representation includes a set of nodes and a set of links where each node represents a customer and each link represents a transaction between two of the customers.

RELATED APPLICATION AND CLAIM OF PRIORITY

This application claims priority to, and incorporates herein byreference, the co-pending U.S. provisional application entitled“Analysis of Third Party Networks” filed Feb. 12, 2002, having Ser. No.60/256,206.

FIELD OF THE INVENTION

This invention relates generally to the field of data mining, or morespecifically methods and systems for analyzing properties or behaviorsof business transactions. In particular, the invention relates to amethod and system for analyzing groups behaviors, characteristics,and/or patterns associated with customer-to-customer businesstransactions in a network, such as a financial network.

BACKGROUND OF THE INVENTION

In financial industries such as the banking industry or the brokerageindustry, a bank or broker provides business opportunities to itscustomers. In banking, the main business includes financial transactionsbetween the bank as a banking business provider and its customers.However, there may be financial transactions conducted between customersthemselves. These customer-to-customer (C2C) transactions may be calledthird party business activities because the provider bank is notfinancially involved in such activities. A group of customers connectedthrough C2C business activities may be called a third party network.Better methods of understanding C2C transactions in groups and thirdparty networks could help financial institutions identify new businessopportunities and solve C2C business problems due to illegal groupactivities, such as money laundering activities and other group relatedfrauds.

One approach to solve such financial problems in a database is datamining. There are two conventional approaches to study or understandtransactions using data mining. One is an individual approach, in whicheach transaction and each customer are analyzed, and patterns associatedwith individual customers may be found. However, this approach does notprovide any analysis of group patterns. Another approach is a groupapproach such as link analysis. Link analysis is a visual data-miningalgorithm that helps to visualize connections between entities linkedthrough transactions or other types of business activities. Incomparison with the individual approach, link analysis shows therelationships and connections between individual entities within alinked group or network.

However, conventional link analysis approaches present severaldisadvantages. A third party network, i.e., one defined by a group ofcustomers connected through C2C business activities, typically has atleast two types of network properties. One is an internal propertydescribing interactions and connections between member customers in anetwork. Link analysis is an adequate technique for analyzing andunderstanding the internal property of a link network. Another type ofnetwork property is an external property describing interactions andconnections between a network (as a group object just like an individualcustomer) and other external entities such as a banking businessprovider. Under the existing link analysis techniques, externalproperties or characteristics of a link network are not apparent. Thus,the prior art presents no reliable way to understand and solve thirdparty business problems, such as money laundering, thus allowing grouppatterns to become evident.

To understand the external property of a link network in solution space,it is desirable to extend link analysis to third-party orcustomer-to-customer network analysis in which business transactionsbetween individual customers within a network and the business providermay be treated as transactions between a network object and the businessprovider. For example, financial transactions between individual membersof a money laundering network and a bank should be treated astransactions between the network and the bank.

SUMMARY OF THE INVENTION

The present invention is directed to the solution of one or more of theproblems described above. In a preferred embodiment, a method ofanalyzing characteristics or behaviors of customers engaged incustomer-to-customer transactions in a third party network includes thesteps of: (i) transforming data representative of a plurality ofindividual customer-to-customer transactions from a data representationto a network representation, and (ii) performing third-party networkanalysis on the network representation. Optionally and preferably, themethod also includes the step of building one or more third-partynetworks corresponding to customer-to-customer transactions. Eachthird-party network preferably represents a group of customers connectedthrough customer-to-customer transactions and comprises a plurality ofnodes and a plurality of links, such that each node is associated withat least one link and each link is associated with at least two nodes.Each node preferably represents a member, customer or individualinvolved in third-party business activity, while each link preferablyrepresents a connection or transaction between two member customers.

Optionally and preferably, each network has internal link patterncharacteristics corresponding to interactions and connections betweenmember customers in the network. Alternately or additionally, eachnetwork preferably has external network pattern characteristics,representing interactions and relationships between a network andexternal entities outside the network.

Optionally and preferably, the performance of third party analysisincludes the performance of network mining using one or more miningalgorithms. For example, the network mining may include decision treemining that stores third-party network patterns in nodes, and at leastone of the nodes may store a subset of networks having similar grouppattern behaviors. Alternatively or in addition, the network mining mayinclude using association rule mining to find networks having importantassociation relationships with external patterns outside networks.Further, the network mining step may include using clustering groupnetworks having similar network properties, and it may detecttransactions that correspond, or that deviate from, a pattern.

In an alternate embodiment of the invention, a method of monitoringcustomer behavior includes the steps of: (i) monitoring data thatcorresponds to a plurality of individual transactions between customers;(ii) transforming the data corresponding to a group of the transactionsinto a network representation; and (iii) analyzing the networkrepresentation of the group of transactions to identify at least onetransaction pattern. Optionally and preferably, the transforming stepincludes the step of building a network comprising a plurality of linksand a plurality of nodes, where each node corresponds to a customer in acustomer-to-customer transaction and each link corresponds to atransaction between two of the customer.

In an alternate embodiment of the invention, a method of monitoringactivity in a network, includes the steps of: (i) monitoring a pluralityof transactions that occur at least partially in a second network; (ii)storing a plurality of nodes in a computer program memory, wherein eachnode comprises data indicative of a participant in one or more of thetransactions; and (ii) storing a plurality of links in the memory,wherein each link is associated with two nodes and each link includesdata indicative of a measurement associated with the transaction betweenthe participants associated with the same two nodes. Preferably, eachtransaction comprises a transaction between two parties and comprises atransfer of funds. Also preferably, the data indicative of a measurementcomprises a customer ID or an account ID, a measure of transactionvalue, a measure of funds, a measure of time, a measure of distancebetween the participants associated with the nodes, or a measure oftransaction frequency.

In this embodiment the method preferably also includes the step ofanalyzing the links to identify at least one group transaction pattern.It may also include the step of detecting a link that corresponds to ordeviates from the at least one group transaction pattern. It may alsoinclude the additional steps of analyzing the links to identify at leastone intra-network group transaction pattern, and analyzing the links toidentify at least one extra-network group transaction pattern.

There have thus been outlined the more important features of theinvention in order that the detailed description that follows may bebetter understood, and in order that the present contribution to the artmay be better appreciated. There are, of course, additional features ofthe invention that will be described below and which will form thesubject matter of the claims appended hereto.

In this respect, before explaining at least one embodiment of theinvention in detail, it is to be understood that the invention is notlimited in its application to the details of construction and to thearrangements of the components set forth in the description orillustrated in the drawings. The invention is capable of otherembodiments and of being practiced and carried out in various ways.Also, it is to be understood that the phraseology and terminologyemployed herein, as well as the abstract, are for the purpose ofdescription and should not be regarded as limiting.

As such, those skilled in the art will appreciate that the conceptionupon which this disclosure is based may readily be used as a basis fordesigning other structures, methods, and systems for carrying out theseveral purposes of the present invention. It is important, therefore,that the claims be regarded as including such equivalent constructionsinsofar as they do not depart from the spirit and scope of the presentinvention.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 illustrates representative business transactions, including C2Ctransactions (arrowed lines), in a data representation.

FIG. 2 illustrates representative business transactions, including C2Ctransactions (arrowed lines), in a pattern (individual pattern)representation.

FIG. 3 illustrates representative business transactions, including C2Ctransactions (arrowed lines), in a link pattern (group pattern)representation.

FIG. 4 illustrates representative business transactions in a networkpattern (group pattern) representation.

FIG. 5 is a flow chart showing steps that may be followed in accordancewith a first part of a preferred embodiment of this invention, namely,the transformation of transaction representations from a data platformto a network platform.

FIG. 6 is a flow chart showing steps that may be followed in accordancewith a second part of a preferred embodiment of this invention, namely,the analysis of group behaviors in a network platform.

FIG. 7 illustrates a sub-tree structure storing networks of differentcharacteristics at various nodes.

FIG. 8 shows a representative computer suitable for carrying out themethods of the present invention, along with an exemplarycomputer-readable carrier.

FIG. 9 illustrates several elements of a preferred embodiment of thecomputer illustrated in FIG. 8.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS OF THE INVENTION

The present invention provides a method and system for the analysis ofgroup properties or group characteristics of Customers connected throughthird-party or customer-to-customer transactions. In particular, theinvention relates to a network representation wherein groups of datavalues describing customer-to-customer business transactions aretransformed into third-party networks. Through this invention, banks,financial service providers, regulators and others can better analyzegroup behaviors of such networks. Thus, they may gain a betterunderstanding of group characteristics or group properties of thethird-party network patterns though the analysis of customer-to-customertransactions or third party business activities, thus allowing thoseusing the method to understand and recognize normal patterns, as well asto quickly identify potential problems because of known problem patternsor deviations from expected patterns.

A primary feature of a preferred embodiment of the invention is thetransformation of C2C business activities from a data representation,where they appear as individual activities between customers, to athird-party network representation where they appear as group activitiesin a third-party network. Group behaviors become more evident, andtherefore are more conveniently analyzed in a third-party networkrepresentation since each group of customers connected through C2Cactivities becomes a single object in the network representation. Thenew network representation forms a third-party network platform.

FIGS. 1-4 illustrate the concept associated with a data representation,as compared to a network representation, and various intermediaterepresentations. Referring to FIG. 1, financial transactions areillustrated in a data representation. Specifically, each transactionbetween banking business provider 10 and customers 1 through 6 isidentified by a unique link. In addition, each transaction between anycustomer and another customer is identified by a unique link.Customer-to-customer transactions are illustrated in FIG. 1 by lineshaving arrows at each end, while customer to business providertransactions are illustrated by lines that contain no arrows. FIG. 2illustrates a pattern representation of the transactions. Rather thanidentifying each individual transaction as a unique link, FIG. 2illustrates only one link between business provider 10 and individualcustomers, or between individual customers, regardless of the number ofactual transactions that occur.

In FIG. 3, the transactions are transformed into a link patternrepresentation. Rather than illustrating each individual customer,customers are combined depending on their transaction patterns. Forexample, in FIG. 2, customers 5 and 6 each engaged in transactions withbusiness provider 10 and they also engaged in customer-to-customertransactions with each other. This unique pattern is illustrated in FIG.3 by link 14, while link 13 is used to show that customer 4 mayparticipate in an intermediate transaction between business provider 10and customer 5. FIG. 4 illustrates the networks that have developed,based on the separation of groups that began to be illustrated in FIG.3. As noted above, customers 5 and 6 in FIG. 3 include a common patternand are linked to business provider 10 by link 14, while customer 5,along with customer 4, also contain a common pattern and are linked tobusiness provider 10 by link 14. FIG. 3 illustrates customers 4, 5 and 6as being combined into a third-party network 22 as the three customersare all linked to each other by customer-to-customer transactions and/ortransactions with business provider 10.

A third-party network platform includes two major parts: networktransform and network analysis. The third-party network transformportion of the platform builds a network platform by transforming C2Cbusiness activities from a data representation into a third-partynetwork representation. The third-party network analysis portion of theplatform performs network queries for analyzing group behaviors andproperties in a standardized manner, in addition to behaviors andproperties of individual customers. A standardized approach forperforming network analysis in a network platform is to build a networkquery language and a network query engine. Since link network analysisis a part of the third-party network analysis, link query languagebecomes a part of network query language.

A third-party network object in a network representation has an internalnetwork structure representing interactions and connections betweenmember customers within a network. The internal structure is describedby a link pattern through description of link pattern properties. Inaddition, a third-party network object has external propertiesdescribing its interactions with an external entity such as a bank.Analysis of both internal link pattern properties and external networkpattern properties provides opportunities for better understanding of anetwork object representing a third party business network in financialindustries.

A preferred embodiment of the present invention provides a method forthe transformation of representations of C2C business activities from adata representation to a third-party network representation and foranalyzing and mining internal link properties and external networkproperties. The preferred method converts a group of customers and C2Cactivities connecting the customers into a third-party networkconsisting of nodes and links. Each node in a third-party networkrepresents a member customer and each link describes a unique C2Cbusiness activity or transaction between two member customers.

An example table showing illustrative data representingcustomer-to-customer transactions. The first two columns representcustomer IDs. The third column shows the amounts of money beingtransferred (brackets represent a transfer in the opposite direction).The last column shows the frequency.

Customer 1 Customer 4 $800,000 5 Customer 2 Customer 6 $150,000 2Customer 3 Customer 5  ($20,000) 2 Customer 4 Customer 8 $1,000,000   5Customer 5 Customer 7  $35,000 3 Customer 6 Customer 9 $100,000 4Customer 5 Customer 10  $10,000 1 Customer 1 Customer 8 $1,500,000   8

Surprisingly and advantageously, we have found that the methodsdescribed herein for the transformation of representations of C2Cbusiness activities from a data representation to a networkrepresentation provides opportunities for better understanding of grouppattern properties by analysis of at least two types of group patternproperties: internal link pattern property and external network patternproperty.

In describing the invention in detail, the following general definitionswill apply to the following terms when used herein. Of course, manyterms are capable of having different but equivalent definitions.Equivalent definitions are also intended to fall within the scope of thepresent invention:

A node represents a member customer involved in a given C2C businessactivity in a third-party network, or a processing or communicationsdevice associated with such a customer.

A link represents a unique C2C business activity or transactionconnecting to two member nodes in a third-party network and describesthe relationships between the two member nodes.

A third-party network represents a group of customers connected throughC2C business activities, or a communications network on which suchcustomers perform such activities.

A dictionary represents a set of unique values of nodes, links, ornetworks.

A measure is a metric measuring nodes, links, or networks.

A frequency measure is a measure of the number of occurrences for anode, link, of network.

A non-frequency measure is a measure of something other than frequency,and preferably of money, time, and/or distance related to a node, link,or network.

A token is an index or key associated with a dictionary value of a nodeor link.

Network Transform

In order to simplify the transformation of groups of customers connectedthrough C2C activities from a data representation to a networkrepresentation, it is preferable to preprocess original data to have asimple format suitable for the network transform before performing anetwork transform. First, one may separate C2C data from other data,especially if the other data includes data describing transactionsbetween customers and the business provider. Then, all C2C data may bestored in a standard format, such as a tabular format in which eachunique C2C activity or transaction is stored in one row. Each such rowwould contain a pair of customers involved in a given C2C activity andmeasure of the C2C activity such as frequency counts of occurrences ofthe activity or the amounts of money involved in the activity. Forexample, a fund transfer between customers is a C2C activity in whichtwo customers are involved and a measure of the transfer can be theamount of money transferred or the number of transactions taking placebetween the two customers. Thus, the standard, and thus a preferred,format for a two-customer activity is customer A (from), customer B(to), and a measure of the transaction or connection between the twocustomers connected through C2C transactions. The measure can be afrequency measure, such as a count of the transaction occurrences, or itmay be a non-frequency measure, such as one of money amounts, involvedin a C2C activity. All binary C2C activities should preferably have thisformat before transformation occurs.

The network transform is intended to convert unstructured C2C businessactivities in a data representation to structured group objects in anetwork representation. In order to make the transform scalable, one mayperform an incremental transform of C2C data from a data representationto a network representation. In an incremental model, a fraction of alarge amount of data is transformed at a time. The results are mergedwith those of the previous increment. These incrementally transformedresults grow in size. The merge allows partial transform completed atany point of increment even when the transform is interrupted due to acrash. The interrupted transform may be resumed at the point where it isinterrupted.

FIG. 5 illustrates a preferred embodiment of the transformation methodsdescribed herein. Referring to FIG. 5, the first step for the transformis to select preprocessed C2C data (step 50). This is preferably carriedout by performing an SQL query with a group-by clause. Selection of C2Cdata is preferably performed incrementally. Each increment comes from arange of data in a relational table. The query results are preferablyunique pairs of customers or accounts and the corresponding measure oflinks connecting pairs of customers.

After selection of data, one may build a dictionary for nodes (step 52).Each dictionary value is a definition for a node. For example, it can bea customer ID, an account ID, or optionally some other value. Nodetokens are used to replace original node values in the selected data forbuilding links and networks more efficiently later on. The nodedictionary should be stored. Node measure, frequency or non-frequencymeasure, may be stored. Frequency counts of occurrences of nodes may beobtained and stored as a frequency measure of nodes. This is an optionbecause the node counts can be obtained from a measure of links thatshould be stored. Similarly, a non-frequency measure, such as the amountof money associated with nodes, may be obtained and stored as anon-frequency measure of nodes. This is also an option. Othernon-frequency measures include: time measure—the amounts of time spentby nodes (e.g., telephone business); measures of distance—totaldistances associated with nodes (e.g., distance between a provider andhis/her customers in medical business, distance between suspects incriminal business or in fraud business). Tokens are used to representvalues of nodes, links, and networks in order to make performance moreefficient. An example of a node dictionary is shown below:

Customer 1 $2,300,000 13 Customer 2 $150,000 2 Customer 3 $20,000 2Customer 4 $1,000,000 5 Customer 5 $65,000 6 Customer 6 $250,000 6Customer 7 $35,000 3 Customer 8 $1,000,000 5 Customer 9 $100,000 4Customer 10 $10,000 1

In the table listed above, the first column shows node values, in thiscase customer IDs. The second column shows the amounts of money for eachnode. The last column shows node frequency

In step 54, after replacing raw data values of nodes by node tokens,link values that are pairs of node values are expressed as pairs oftokens. A dictionary for links or pairs of tokens is built and stored.An example of such a link dictionary, with values, is illustrated below:

1 4 $800,000 5 2 6 $150,000 2 3 5  ($20,000) 2 4 8 $1,000,000   5 5 7 $35,000 3 6 9 $100,000 4 5 10  $10,000 1 1 8 $1,500,000   8

In the table above, the first two columns show link values, or pairs ofnode tokens. The third column shows the amounts of money for each linkwith direction (brackets for opposite direction). The last column showslink frequency.

Preferably, as shown above, a measure of links is also stored. Frequencycounts of occurrences of links are obtained and stored as a frequencymeasure of links. Non-frequency measures may be also obtained and storedif needed.

The final step illustrated in FIG. 5 (step 56) is to build networks inthe new network representation. This is a process of obtaining networksfrom links. A dictionary for networks is built and stored. Eachdictionary value represents a set of links connected through C2Cactivities. An example of such a network dictionary, with exemplaryvalues, with each row representing a network, is illustrated below:

1, 4 1, 8 4, 8  2, 6 6, 9 3, 5 5, 7 5, 10

As an option, one may obtain and store frequency and non-frequencymeasures of networks. Unlike node and link measures, there is no singledefinition for frequency measure of networks since links within anetwork may have different frequency counts. Choices of mean, sum,minimum, maximum, or average deviation may be made. Similar choices fornon-frequency measures of networks may be made also.

Third-Party Network Analysis

A primary function of third-party network analysis is to study andunderstand network properties including both internal properties andexternal properties. The internal properties reflect the characteristicsand properties of C2C transactions within each network, and may beanalyzed using conventional techniques for link analysis. The externalproperties represent all other transactions than C2C transactions, suchas transactions between customers and the business provider—a bank inbanking business or a brokerage firm in brokerage industry. Theseproperties are analyzed using a network approach. The main differencebetween a third-party network analysis and other pattern analyses is totreat a network of customers connected through third-party activities asa single customer-like network object, instead of treating eachindividual customer as an object. All the techniques developed foranalysis and data mining of individual patterns may be used forthird-party network analysis and third-party network mining by replacingindividual objects by network objects.

One important element for performing network analysis in a third-partynetwork platform is to have a network query language. The network querylanguage is intended to provide the functionality of performing C2Cnetwork queries either in a network platform or in a hybrid platformconsisting of a network platform and a data platform. Also, it providesquery capability difficult to perform for data query languages such asSQL. A SQL-like network language would be more attractive to therelational database users. A typical process for network analysis isshown in FIG. 6. For analysis of the internal characteristics ofnetworks, a query engine may select networks satisfying the internalconstraints 58 shown in FIG. 6 and perform data mining (step 68) on thecharacteristics of the network internal structures. Similarly, the queryengine may select networks satisfying external constraints 60 andperform data mining (step 72) on the external characteristics of thenetworks for analysis of external properties of networks.

In general, there are two types of results from third-party networkanalysis, coming out from internal 68 and external 72 data mining asshown in FIG. 6. One describes internal properties of networks, namelyresults from link analysis of connections and relationships betweenmember customers within a network. The other describes externalproperties of networks representing interactions between a customernetwork and a business provider such as a bank, as if each networkappeared like an individual customer. Similarly, there are two types ofnetwork constraints: internal constraints and external constraints, asshown in FIG. 6.

Third-party network analysis may be performed using conventional datamining algorithms developed for mining individual patterns, such asassociation rules, clustering, neural networks, and decision tree. Themain difference is that these algorithms are used to mine networkpatterns or group patterns in third-party network analysis, instead ofindividual patterns. For example, a decision tree may be built toclassify and store third-party network patterns in various nodes. Eachnode stores network patterns having different pattern properties fromnetwork patterns in each other node, as illustrated in FIG. 7. Also,association rules may be used to measure and mine relationships betweena network and external entities.

Examples of network properties of third-party networks are given asfollows. In brokerage industry, a brokerage firm has a number ofcustomers. The main business activities are financial transactionsbetween the firm and its customers. However, some customers havefinancial transactions between themselves. A C2C network represents agroup of customers connected through C2C transactions. A typical networkis a pension trust network in which a number of pension trust accountsare connected through transactions regularly between a central accountand the rest in the network. In this case, C2C pension trust business isconducted through a pension trust network. Another typical network is astock option network in which a number of individual accounts and acompany account are set up for C2C transactions. Customers of theindividual accounts are employees of the company. C2C transactionsbetween individual accounts and the company account represent activitiesrelated to the company's stock options. Another typical network is a feenetwork in which C2C transactions represent fee payments between membercustomers in a fee network.

All of the above examples show typical third party businesses that arelegal. However, there are C2C networks in which third party transactionsare illegal. For example, a money-laundering network represents a groupof customers transferring funds between them. The source of these fundscomes from illegal activities. Link analysis of C2C transactions in amoney-laundering network may not be sufficient for identification of themoney-laundering problem. Third-party network analysis of such networksprovides additional opportunity for more complete understanding of theproblem. The characteristics of the networks in the above examples maybe described by various nodes in a sub-tree structure as shown in FIG.7.

External Properties

To demonstrate external properties of networks, we use the example shownearlier may be used to illustrate a network transform. Consider themethod performing a network query to show account registration types forcustomers in each network. The query may find, for example, that allcustomers in the first network have account registration type of PT,meaning in this example pension trust. The other two networks have asimilar pattern in registration types. One customer in each network hasaccount registration type of CORP, meaning in this example company. Theother customers in each network have account registration type of IN,meaning in this example individual. It turns out that the first networkis a pension-trust network consisting of three pension-trust accountsmanaged by a company. The company manages pension-trust investment forthree clients. Each account is set up for one of its clients. Financialtransactions between the three accounts represent allocations ofdiversified investment. Perform a network query to show account segmenttype for the remaining networks. All customers in the second networkhave a type of employee stock option action (ESOS) for stock optiontype. This network turns out to be a stock-option network. Typically, acompany may set up an account for the company and a few accounts for itskey employees having stock options. Transactions between the companyaccount and the employees' accounts reflect stock option exercises bythe employees. In the example, further study of the third network showsa pattern: one account (CORP) in the network receives funds fromoverseas and distributes the funds to the other three accounts. Onescenario for such pattern could be a money laundering network.

Exemplary Apparatus

Certain portions of the invention may be performed by an automatedprocessing system. Viewed externally in FIG. 8, an exemplary computersystem designated by reference numeral 101 has a central processing unitlocated within a housing 108 and disk drives 103 and 104. Disk drives103 and 104 are merely symbolic of a number of disk drives which mightbe accommodated by the computer system. Typically these would include ahard disk drive and optionally one or more floppy disk drives such as103 and/or one or more CD-ROMs, CD-Rs, CD-RWs flash memory, memory stickor digital video disk (DVD) devices indicated by slot 104. The numberand types of drives typically varies with different computerconfigurations. Disk drives 103 and 104 are in fact options, and theymay be omitted from the computer system used in connection with theprocesses described herein. An exemplary type of storage media 110,which may serve as a carrier for program instructions, is alsoillustrated. Additionally, the computer system utilized for implementingthe present invention may be a stand-alone computer havingcommunications capability, a computer connected to a network or able tocommunicate via a network, a handheld computing device, or any otherform of computing device capable of carrying out equivalent operations.

The computer also has or is connected to or delivers signals to adisplay 105 upon which graphical, video and/or alphanumeric informationis displayed. The display may be any device capable of presenting visualimages, such as a television screen, a computer monitor, a projectiondevice, a handheld or other microelectronic device having video displaycapabilities, or even a device such as a headset or helmet worn by theuser to present visual images to the user's eyes. The computer may alsohave or be connected to other means of obtaining signals to beprocessed. Such means of obtaining these signals may include any devicecapable of receiving images and image streams, such as video input andgraphics cards, digital signal processing units, appropriatelyconfigured network connections, or any other microelectronic devicehaving such input capabilities.

An optional keyboard 106 and a directing device 107 such as a remotecontrol, mouse, joystick, touch pad, track ball, steering wheel, remotecontrol or any other type of pointing or directing device may beprovided as input devices to interface with the central processing unit.

FIG. 9 illustrates a block diagram of the internal hardware of thecomputer of FIG. 8. A bus 256 serves as the main information highwayinterconnecting the other components of the computer. CPU 258 is thecentral processing unit of the system, performing calculations and logicoperations required to execute a program. Read only memory (ROM) 260 andrandom access memory (RAM) 262 constitute the main memory of thecomputer.

A disk controller 264 interfaces one or more disk drives to the systembus 256. These disk drives may be external or internal floppy diskdrives such as 270, external or internal CD-ROM, CD-R, CD-RW flashmemory, memory stick or DVD drives such as 266, or external or internalhard drives 268 or other many devices. As indicated previously, thesevarious disk drives and disk controllers are optional devices.

Program instructions may be stored in the ROM 260 and/or the RAM 262.Optionally, program instructions may be stored on a computer readablecarrier such as a floppy disk or a digital disk or other recordingmedium, a communications signal, or a carrier wave.

Returning to FIG. 9, a display interface 272 permits information fromthe bus 256 to be displayed on the display 248 in audio, graphic oralphanumeric format. Communication with external devices may optionallyoccur using various communication ports such as 274.

In addition to the standard components of the computer, the computeralso includes an interface 254 which allows for data input through thekeyboard 250 or other input device and/or the directional or pointingdevice 252 such as a remote control, pointer, mouse or joystick

Transformation Process

The many features and advantages of the invention are apparent from thedetailed specification. Thus, the appended claims are intended to coverall such features and advantages of the invention which fall within thetrue spirits and scope of the invention. Further, since numerousmodifications and variations will readily occur to those skilled in theart, it is not desired to limit the invention to the exact constructionand operation illustrated and described. Accordingly, all appropriatemodifications and equivalents may be included within the scope of theinvention.

1-31. (canceled)
 32. A method of monitoring activity in a network,comprising: monitoring a plurality of transactions that occur at leastpartially in a second network; storing, in a computer program memory, aplurality of nodes, wherein each node comprises data indicative of aparticipant in one or more of the transactions; and storing, in thecomputer program memory, a plurality of links, wherein each link isassociated with two nodes, and each link comprises data indicative of ameasurement associated with the transaction between the participantsassociated with the same two nodes.
 33. The method of claim 32, whereineach transaction comprises a transaction between two parties.
 34. Themethod of claim 32, wherein each transaction comprises a transfer offunds.
 35. The method of claim 32, wherein the data indicative of ameasurement comprises a customer ID or an account ID.
 36. The method ofclaim 32, wherein the data indicative of a measurement comprises ameasure of transaction value, a measure of funds, a measure of time, ameasure of distance between the participants associated with the nodes,or a measure of transaction frequency.
 37. The method of claim 32,further comprising analyzing the links to identify at least one grouptransaction pattern.
 38. The method of claim 37, further comprisingdetecting a link that deviates from the at least one group transactionpattern.
 39. The method of claim 37, further comprising detecting a linkthat corresponds to a pre-identified transaction pattern.
 40. The methodof claim 32, further comprising: analyzing the links to identify atleast one intra-network group transaction pattern; and analyzing thelinks to identify at least one extra-network group transaction pattern.41. The method of claim 40, further comprising detecting a link thatdoes not conform to any applicable group transaction pattern.
 42. Themethod of claim 40, further comprising detecting a link that correspondsto a pre-identified transaction pattern.
 43. A computer-readable mediumfor monitoring activity in a network, having sets of instructions storedthereon which, when execute by a computer, cause the computer to:monitor a plurality of transactions that occur at least partially in asecond network; store, in a computer program memory, a plurality ofnodes, wherein each node comprises data indicative of a participant inone or more of the transactions; and store, in the computer programmemory, a plurality of links, wherein each link is associated with twonodes, and each link comprises data indicative of a measurementassociated with the transaction between the participants associated withthe same two nodes.
 44. The computer-readable medium of claim 43,wherein each transaction comprises a transaction between two parties.45. The computer-readable medium of claim 43, wherein each transactioncomprises a transfer of funds.
 46. The computer-readable medium of claim43, wherein the data indicative of a measurement comprises a customer IDor an account ID.
 47. The computer-readable medium of claim 43, whereinthe data indicative of a measurement comprises a measure of transactionvalue, a measure of funds, a measure of time, a measure of distancebetween the participants associated with the nodes, or a measure oftransaction frequency.
 48. A system for monitoring activity in anetwork, the system comprising: a storage device; and at least oneprocessor in communication with the storage device, wherein the storagedevice has sets of instructions stored thereon which, when execute bythe at least one processor, cause the at least one processor to: monitora plurality of transactions that occur at least partially in a secondnetwork; store, in a computer program memory, a plurality of nodes,wherein each node comprises data indicative of a participant in one ormore of the transactions; and store, in the computer program memory, aplurality of links, wherein each link is associated with two nodes, andeach link comprises data indicative of a measurement associated with thetransaction between the participants associated with the same two nodes.49. The system of claim 48, wherein the sets of instructions whenfurther executed by the at least one processor, cause the at least oneprocessor to analyze the links to identify at least one grouptransaction pattern.
 50. The system of claim 49, wherein the sets ofinstructions when further executed by the at least one processor, causethe at least one processor to detect a link that deviates from the atleast one group transaction pattern.
 51. The system of claim 49, whereinthe sets of instructions when further executed by the at least oneprocessor, cause the at least one processor to detect a link thatcorresponds to a pre-identified transaction pattern.